Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b52f09c4 authored by Noralf Trønnes's avatar Noralf Trønnes
Browse files

drm/fb-helper: Avoid NULL ptr dereference in fb_set_suspend() 



drm_fb_helper_resume_worker() uses fb_helper->fbdev to call
fb_set_suspend() which dereferences the pointer.
Move sync-canceling of the resume worker in drm_fb_helper_fini() before
setting fb_helper->fbdev to NULL. Move dirty_work as well.

Signed-off-by: default avatarNoralf Trønnes <noralf@tronnes.org>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: default avatarLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1503940668-25883-2-git-send-email-noralf@tronnes.org
parent 4930a433

drivers/gpu/drm/drm_fb_helper.c

+3 −3
Original line number Diff line number Diff line
@@ -910,6 +910,9 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper) 
	if (!drm_fbdev_emulation || !fb_helper)

		return;



	cancel_work_sync(&fb_helper->resume_work);

	cancel_work_sync(&fb_helper->dirty_work);



	info = fb_helper->fbdev;

	if (info) {

		if (info->cmap.len)
@@ -918,9 +921,6 @@ void drm_fb_helper_fini(struct drm_fb_helper *fb_helper) 
	}

	fb_helper->fbdev = NULL;



	cancel_work_sync(&fb_helper->resume_work);

	cancel_work_sync(&fb_helper->dirty_work);



	mutex_lock(&kernel_fb_helper_lock);

	if (!list_empty(&fb_helper->kernel_fb_list)) {

		list_del(&fb_helper->kernel_fb_list);